Vulnerability in Budibase Low-Code Platform Exposing REST Secrets

CVE-2026-48152

What is CVE-2026-48152?

In the Budibase low-code platform, prior to version 3.39.0, a security flaw exists that allows users with a Basic app role to exploit inadequately protected GET and PUT routes. These routes lack specific ownership and permission checks, allowing unauthorized access to sensitive REST datasource configurations. Users can manipulate requests to retrieve and alter data, leading to potential exposure of builder-configured REST Authorization secrets. This vulnerability has been addressed in version 3.39.0.

References